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Abstract — A distinct difference configuration is a set of points 
in I? with the property that the vectors (difference vectors) 
connecting any two of the points are all distinct. Many specific 
examples of these configurations have been previously studied: 
the class of distinct difference configurations includes both Costas 
arrays and sonar sequences, for example. 

Motivated by an application of these structures in key pre- 
distribution for wireless sensor networks, we define the fc-hop 
coverage of a distinct difference configuration to be the number 
of distinct vectors that can be expressed as the sum of k or 
fewer difference vectors. This is an important parameter when 
distinct difference configurations are used in the wireless sensor 
application, as this parameter describes the density of nodes that 
can be reached by a short secure path in the network. We provide 
upper and lower bounds for the fc-hop coverage of a distinct 
difference configuration with m points, and exploit a connection 
with Bh sequences to construct configurations with maximal fc- 
hop coverage. We also construct distinct difference configurations 
that enable all small vectors to be expressed as the sum of two 
of the difference vectors of the configuration, an important task 
for local secure connectivity in the application. 

Index Terms — Data Security, Key Predistribution, Wireless 
Sensor Networks 



I. Introduction 

A distinct difference configuration DD(m) is a set of m 
dots in a square grid, with the property that the lines 
joining distinct pairs of dots are all different in length or slope. 
For instance, the dots depicted in the following array form a 
DD(3): 



If we pick a position on the square grid to be the origin, we 
may think of the dots in a DD(to) as a set {vi, V2, . . . , v™} 
of vectors in 1?. The condition that the dots form a DD(m) 
is then the same as the condition that the difference vectors 
Vi — Vj with i ^ j are all distinct. So we may think of the 
dots in the example above as the set {(0, 0), (1, 2), (2, 1)} of 
vectors; it is easy to verify that the six difference vectors are 
all different in this case. 

Many special classes of distinct difference configurations 
have been studied previously: these include B2 sequences 
over Z and Golomb rulers in the one-dimensional case, and 
Costas arrays, Golomb rectangles and sonar sequences in 
the two-dimensional case. See [1] for a summary of these 
configurations. 
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This paper is concerned with the k-hop properties of distinct 
difference configurations. Before we explain this, we first need 
to discuss an application to key predistribution in grid-based 
wireless sensor networks due to Blackburn, Etzion, Martin and 
Paterson [2] that motivates our work. 

A. Wireless Sensor Networks 

A wireless sensor network is a large collection of small 
sensor nodes that are equipped with wireless communication 
capability. Sensor nodes have limited communication range 
and thus data transmitted over the network is typically passed 
from node to node in a series of hops in order to reach 
its end destination. Such networks can be employed for a 
wide range of applications [3], whether scientific, commercial, 
humanitarian or military. The data being transmitted over the 
wireless medium is frequently valuable or sensitive; hence, 
there is a need for cryptographic techniques to provide data 
integrity, confidentiality and authentication. 

On deployment, the sensor nodes aim to form a secure and 
connected network. In other words, we desire a significant 
proportion of nodes within communication range to share 
cryptographic keys. The nodes' size limits their computa- 
tional power and battery capacity, so it is assumed that the 
sensor nodes are unable to use public key cryptography to 
establish shared keys. So symmetric cryptographic keys are 
preloaded onto each node before deployment: methods for 
deciding which keys are assigned to a node are known as 
key predistribution schemes (see [4]-[6] for surveys of this 
subject). The sensor nodes are assumed to be highly vulnerable 
to compromise, so a single key should not be given to too 
many nodes. A balancing constraint is that each node can 
only store a limited number of keys. The aim is to design 
an efficient and secure key predistribution scheme so that a 
sensor node can establish secure wireless links with many of 
its neighbours: it is important to establish as many short secure 
links in the network as possible, since the nodes' capacity to 
relay information is very limited. 

Key predistribution schemes for wireless sensor networks 
generally assume that the precise location of nodes is not 
known before deployment, hence schemes such as [7] aim to 
provide reasonable levels of "average" connectivity across the 
entire network. However in many applications the location of 
sensor nodes can be determined prior to deployment. In such 
cases this knowledge can be used to improve the efficiency of 
the underlying key predistribution scheme. One such scenario 
is that of networks consisting of a large number of sensor 
nodes arranged in a square grid. Grid-based networks can 
arise in many applications, including soil moisture sensing [8], 
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monitoring conditions in an orchard [9], and measuring the 
efficiency of water use during irrigation [10]. 

B. Key P redistribution for a Grid-based Network 

In [2] a key predistribution scheme for a grid-based network 
was proposed and analysed. This scheme was shown to be 
significantly more efficient than using general approaches such 
as that of [7]. We now discuss this scheme in more detail. 

Although the number of sensor nodes is evidently finite in 
practice, it is convenient to model the physical location of the 
nodes by the set of points of 1?. The scheme in [2] employs a 
distinct difference configuration to create a key predistribution 
scheme in the following way. 

Scheme 1 Let D = {vi, V2, . . . , v^} be a distinct difference 
configuration. Allocate keys to nodes as follows: 

• Label each node with its position in I?. 

• For every 'shift' u G Z^, generate a key and assign 
to the nodes labelled by u + Vj, for i = 1,2, ... ,m. 

More informally, we can think of the scheme as covering 7? 
with all possible translations of the dots in D. We generate 
one key per translation, and assign that key to all dots in 
the corresponding translation of D. Distributing keys in this 
manner ensures that each node stores m keys and each key is 
shared by m nodes. In addition, the distinct difference property 
of the configuration implies that any pair of nodes shares at 
most one key, since the vector representing the difference in 
two nodes' positions can occur at most once as a difference 
vector of D. This leads to an efficient distribution of keys, 
since for a fixed number of stored keys the number of distinct 
pairs of nodes that share a key is maximised. 

As an example, consider the distinct difference configu- 
ration given at the start of this introduction. If we use this 
configuration for key distribution in Scheme [T] each node 
stores three keys. Figure [T] illustrates this key distribution: 
each square in the grid represents a node, and each symbol 
contained in a square represents a key possessed by that node. 
The central square stores keys marked by the letters A, B 
and C; two further nodes share each of these keys, which are 
marked in bold. Letters in standard type represent keys used to 
connect the central node to one of its neighbours via a two-hop 
path, other keys are marked in grey. Note that we have only 
illustrated some of the keys; the pattern of key sharing extends 
in a similar manner throughout the entire network. See [2] 
for a comparison of how Scheme [T] outperforms related key 
predistribution schemes in the literature. 

Note that the sensors' strictly limited battery power limits 
the range over which they can feasibly communicate. In 
support of Scheme [T] distinct difference configurations with 
bounds on the distance between any two dots in the configu- 
ration were considered in [2]. Supposing that each sensor has 
a fixed communication range r, a DD(TO,r) is defined to be 
a DD(m) in which the Euclidean distance between any two 
points of the configuration is at most r. From an application 
point of view, it is only necessary for a pair of nodes to share 
a key if they are located within communication range of each 
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Fig. 1. Key distribution using a distinct difference configuration. 



Other; the use of a DD(m,r) in Scheme [T| ensures that this is 
the case. 

While Scheme [T] was designed to suit wireless sensor 
networks in which the sensors are arranged in a square grid, for 
certain applications a hexagonal arrangement of sensor nodes 
may be preferred, as it yields the most efficient packing of 
sensors (see [11] for details of circle packings in the plane). 
Section defines the hexagonal model more precisely and 
discusses the relationship between the two models. Scheme [T] 
is easily adapted to suit sensors arranged in a hexagonal grid 
by replacing the DD(m) by a DD*(7ti), which we informally 
define to be a set of m dots on a hexagonal grid such that the 
vector differences between pairs of dots are distinct. We define 
a DD* (to, r) to be a DD* (m) in which the Euclidean distance 
between any pair of dots is at most r. Another model that is 
natural when working with either the square or hexagonal grids 
is to replace the Euclidean metric by its discrete equivalent: the 
Manhattan metric (in the case of square grids), or an analogous 
metric on the hexagonal grid; in this case, we use the notation 
DD(m, ?') and DD {rn,r), respectively. Constructions and 
bounds on the parameters for such configurations were studied 
in [1]. Section HI] contains a summary of the relationships 
between configurations based on different grids when using 
different metrics. 

C. Contributions 

Recall that wireless sensor networks rely on data being 
relayed via intermediate nodes using a series of hops. From 
an efficiency perspective it is thus of interest to consider 
properties relating to the nodes that can be reached from a 
specific node by means of a restricted number of hops. 

If two nodes A and B are within communication range and 
share a key we say there is a one-hop path between A and B. 
If they do not share a key, however, they may still be able to 
establish a secure connection if there is a node C that is within 
range of A and B and shares a key with each of them. This is 
referred to as a two-hop path; more generally we consider k- 
hop paths of the form A~Ci — C2...~Ck-i~B, where there 
is a one-hop path between any two adjacent users in the chain. 
A significant, and widely studied, measure of the performance 
of a key predistribution scheme for a wireless sensor network 
is the expected number of nodes with which a given node 
can communicate via a one hop or two-hop path (we do not 
count the given node in this total). As in [2], we refer to 
this parameter as the two-hop coverage of the scheme. More 
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generally, we can define the k-hop coverage to be the expected 
number of nodes with which a given node can communicate 
via some £-hop path with 1 < £ < k (where we do not count 
the given node itself). 

This measure is important from the point of view of our 
application, since it captures the ability of the network to 
transmit information in the context of the nodes' limited 
capacity to relay messages. The case when fc = 2 is the most 
studied situation in the literature, since results are often easier 
to establish than in the general fc-hop case. Lee and Stinson 
use the notation Pri + Pr2 to describe this quantity, referring 
to it as the local connectivity [12]; similar metrics are used 
in [13], [14], and various related measures of the expected 
number of hops required for secure communication between 
two nodes are prevalent in the sensor network literature [7], 
[15], [16]. 

We define the fc-hop coverage of a distinct difference con- 
figuration to be the fc-hop coverage of the resulting instance of 
Scheme [T] In [2] a number of distinct difference configurations 
with good two-hop coverage were found by computer search. 
However no concrete construction techniques were provided. 
In this paper we provide an exposition of the two-hop coverage 
case, as well as consider the generalisation to fc-hop coverage. 

Section |lll] is devoted to a study of the fc-hop coverage 
Ck(D) obtained by the use of the distinct difference configu- 
ration D = {vi, V2, . . . , Vm} in Scheme [T] Subsection IIII-AI 
shows how to calculate the fc-hop coverage from the vectors 
Vi, V2, . . . , In Subsection IIII-BI we study configurations 
where Ck{D) is as large as possible, and show a connection 
between such configurations and B]^ sequences (a well studied 
concept in combinatorial number theory). We determine the 
maximum value of the fc-hop coverage Ck{D) where is a 
DD(m) (or a DD*(m)), and show that D achieves this level 
of fc-hop coverage if and only if is a B2k sequence. If we 
restrict D to be a DD(m, r) for some small integer r, we might 
no longer be able to achieve this maximum value of Ck{D): 
we provide bounds on the smallest value of r for which there 
exists a configuration D which is a DD{m,r) with Ck{D) 
maximal. We also provide similar bounds on this smallest 
value of r when we consider configurations DD* (m, r) in 
the hexagonal grid. Finally, in Subsection IIII-CI we provide a 
lower bound on Ck{D) and characterise those configurations 
that meet this lower bound. 

Using a distinct difference configuration with maximal fc- 
hop coverage ensures that as many users as possible are 
connected by fc-hop paths. However, in many applications 
these paths are used to establish keys which are later used 
for direct communication between the two end nodes: thus we 
are only interested in fc-hop paths whose start and end nodes 
are within communication range. For these applications, rather 
than optimising the total number of pairs of users connected by 
fc-hop paths we wish to optimise coverage in a locally defined 
region: We say that a DD(m) or DD*(m) achieves complete 
k-hop coverage with respect to a region R and point p G i? 
if every point in R can be reached by a two-hop path from p. 
This means that every node u can communicate via a fc-hop 
path with the nodes in the region corresponding to a shift of R 
that moves p to u, giving Scheme [T]good local connectivity. In 
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Fig. 2. A transformation from a liexagonal grid to a square grid (grid points 
are represented by tlie centres of tlie cells). 



Section |IV] we give a construction for a DD(?t!,) that achieves 
complete two-hop coverage with respect to the centre of a 
(2p — 3) X {2p — 1) rectangle when p is prime. 

II. Different Grids and Different Metrics 
A. Square and Hexagonal Grids 

Suppose that the sensor nodes are arranged in a square grid, 
and the shortest distance between a pair of nodes is 1. So we 
tile the plane by unit squares, and think of the nodes as lying 
at the centres of these squares. By supposing one of the nodes 
is at the origin, the location of a node can be identified with 
a vector in 1?. Because of this, we call Z"^ the square grid. 

A hexagonal arrangement of sensor nodes is obtained by 
tiling the plane with regular hexagons and placing a node 
at the centre of each hexagon. We suppose that one of the 
nodes is located at the origin and the shortest distance between 
two nodes is 1. In a similar way to the square grid, the 
locations of the nodes can be represented by vectors in the 
set Ah = {X{1,0) + fi{-l/2,V3/2)\X,p e Z}, which we 
call the hexagonal grid. 

We have already defined a (square) distinct difference 
configuration DD(to) to be a set D = {vi, V2, . . . , v„i} C 
of m dots with the property that the difference vectors — 
for i ^ j between any pair of dots are distinct. In the same 
way, we define a (hexagonal) distinct difference configuration 
DD*(m) to be a set 13 = {vi, V2, . . . , v„i} C A^f of m dots 
in the hexagonal grid with the property that the difference 
vectors — Vj for i 7^ j are distinct. A hexagonal distinct 
difference configuration can be used in Scheme [T] for sensors 
arranged in a hexagonal grid, provided that shifts u G Ah are 
used: as in the square grid, every node is assigned m keys and 
the distinct difference property implies that any pair of nodes 
has at most one key in common. We define a DD*(m, r) to be 
a DD* (m) in which the Euclidean distance between any pair 
of dots in the configuration is at most r: these configurations 
must be used when the wireless communication range of a 
sensor node is r. 

The map ^; ^ defined by 



, , y 2y 



induces a bijection from Ah to Z. This is illustrated in Fig. |2] 
in which the cells whose centres form the points of the grid 
are depicted. We can use ^ and to convert a DD*(m) into 
a DD(m) and vice versa: 
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(a) Lee sphere of radius 2 (b) Hexagonal ball of radius 1 

Theorem 1. If D = {vi, V2, . . . , Vm} is a DD*(m), then 
^{D) = {^(vi), e(v2), . . . , e(v™)} is a DD(m). Similarly, if 
D' isaDD(m), then^-'^{D') is a DD*(m). 

Proof: Since ^ is a linear bijection, we have that v, — Vj = 
Vfe - if and only if ^(v^) - ^(v^) = ^(v^) - ^(v<>); the 
first statement of the theorem follows directly. The second 
statement follows as is also a linear bijection. ■ 
Despite Theorem [T] the square and hexagonal models differ 
once we are interested in distances between dots, since ^ does 
not preserve Euclidean distances. Fig. |2] shows a line segment 
of length -\/3 that transforms into one of length %/2, and one 
of length 1 that also transforms into one of length V2- It is 
straightforward to show that these line segments represent the 
maximum extent to which ^ can extend or contract the length 
of a vector; we formalise this in the following theorem: 

Theorem 2. IfD is a DD* (m, r) then £,{D) is a DD(m, r\/2). 
IfD' is a DD(m, r), then ^-^{D') is a DD*(m, 7-^372). 

Thus we can convert between results about DD(m, r) and re- 
sults about DD* (m, r) (although the bounds on the converted 
lengths are not tight in general). 

B. Alternative Metrics on Grids 

In [2], the need to take sensor nodes' communication range 
into account when using distinct difference configurations to 
distribute keys to sensors arranged in a square grid motivated 
the definition of a DD(m, r) based on a Euclidean measure 
of distance. However, when working with a square grid it 
is natural to consider the Manhattan metric (also known as 
the Lee metric), in which the distance between dots with 
coordinates {iiji) and (22,^2) is given by |«i -12! + |ji - j2|- 
Distinct difference configurations DD(TO,r) in which the 
distance between dots in the configuration is at most r in the 
Manhattan metric were studied in [1]. A ball of radius r in this 
metric is referred to as a Lee sphere (Fig. |3ali, and for small 
r gives a reasonable approximation of a Euclidean circle. The 
well-known relation between these two metrics is expressed 
in the following theorem, which permits conversion between 
results about DD(m,r) and results about DD(m, r). 

Theorems. For r S Z, a DD(m, r) is a DD(TO,r) and a 
DD(m,r) is a DD(m, \V2r]). 

For the hexagonal grid, we say that a given point is adjacent 
to the six grid points that lie at Euclidean distance 1 from 
that point (for example, in Fig. |2] the points at the centres 
of cells 1,2,..., 6 are adjacent to the point at the centre 
of cell 0). We can then define a graph in which the grid 
points correspond to vertices, with edges connecting vertices 



whose grid points are adjacent. This gives rise to a hexagonal 
metric in which the distance between two points is the length 
of the shortest path between the corresponding vertices in 
the graph. A distinct difference configuration in which the 
hexagonal distance between any two points is at most r is 
denoted DD (m, r). The relation between the hexagonal and 
Euclidean metrics can be used to prove the following theorem: 

Theorem 4. For ?■ e Z, a DD {m,r) is a DD*(TO,r) and a 
DD* (m, r) is a DD* (m, [^r] ). 

We note that the hexagonal metric gives a closer approxima- 
tion to the Euclidean distance than the Manhattan metric. 

III. fc-Hop Coverage 

In this section we investigate the properties of distinct 
difference configurations with respect to their fc-hop coverage. 
While the motivation for this work comes from the application, 
the results are of independent combinatorial interest. 

A. Characterising k-hop coverage 

Let D he a (square or hexagonal) distinct difference config- 
uration given hy D = {vi,V2, . . . , v™}. Define Ck{D) to be 
the number of non-zero vectors that can be written as the sum 
of k or fewer difference vectors. So Ck{D) is the number of 
non-zero vectors of the form 
e 

where ai,Pi G {l,2,...,m} with at ^ Pi and where < 
i<k. 

Theorems. Suppose that D is used in Scheme\l\ Then the k- 
hop coverage of the scheme is equal to Ck (D). 

Proof: Let x be any fixed node. Two nodes that share 
a key are located at points of the form Vi + u and vj + u 
for some i,j G {1,2,..., m} and some shift u. This implies 
that the vector difference between their positions is v; — Vj, 
which is a difference vector of D. Hence a one-hop path 
between nodes with keys distributed according to Scheme [T] 
corresponds to a difference vector of the underlying distinct 
difference configuration. So there is an £-hop path from x to 
another node y if and only if the vector difference between 
their positions is the sum of £ difference vectors. Note also 
that X = y if and only if this sum is the zero vector: since we 
do not count x in the fc-hop coverage, we are only interested in 
sums of the form ([T]i which are non-zero. So Ck(D) is equal 
to the fc-hop coverage of Scheme [T] implemented using D, as 
required. ■ 

Theorem 6. Let ^ : ^ be the map defined in Section^ 
Let D be a DD*(m) and let D' be a DD(to) such that 
D' = ^{D). Then the k-hop coverage of D is equal to the k-hop 
coverage of D' . 
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Proof: Theorem |5] shows that we must show that 
Ck{D) = Ck{D'). But Ck{D) and Ck{D') both count the 
number of non-zero vectors that can be expressed as the sum 
of k or fewer difference vectors (of D or D' respectively). 
The theorem now follows, since ^ is a linear bijection. ■ 

B. Maximal k-hop coverage 

In this subsection we determine the maximal fc-hop coverage 
of a DD(m). By Theorem |6l these results apply equally to 
a DD*(m). We begin with some preliminary notation and 
lemmas. 

For a non-negative integer k we define a set of m-tuples 
of integers as follows: 



Hk = { (ai,a2,...,am) G Z" 



TABLE I 
Counting elements in H2 



i=l 



0, 

{i:ai>0} ) 

For example, when m = 3 the triple (0,0,0) is the unique 
element of Hq, the triple (1,-1,0) is a typical element of 
Hi, and the triples (2, -2, 0), (2,-1, -1) and (1, 1, -2) are 
typical elements of H2- The following results about the sets 
Hk are easily proved. 

Lemma 7. Define the sets Hk as above. 

(i) Let a e H^^ and b G Hk2 ■ Then a + b e H^^ where k^ 
is an integer satisfying < ^3 < fci + ^2. In particular, 
if a non-zero m- tuple v is a sum of k m-tuples from Hi, 
then V £ Hk^ for some k^ satisfying 1 < k^ < k. 

(ii) Let a G H^^ andh G Hk^ with a ^ b. Then a — b e H^^ 
where k^ is an integer satisfying I < k^ < ki + k-z. 

(Hi) Any element of H^^ may be written as the sum of ki 
elements from Hi. 

The connection between Hk and the A: -hop coverage of 
DD(?Ti) is given by the following theorem: 

Theorems. The k-hop coverage of a DD(m) is at most 
X]i=i ^^f^ equality if and only if all the vectors 

1 "iVi with (ai, a2, . . . , a„) e lJj=o distinct. 

Proof: The difference vectors of D are precisely the 
vectors of the form J2"Li '^i^i where a G i/i. By Lemma|2](i) 
and (iii), a vector is a sum of k or fewer difference vectors 
if and only if it can be written in the form X^t^i '^i^i 
with {ai,a2, ■ ■ ■ ,am) & [jj=o^j- The zero vector can al- 
ways be written in this form, since the sum is zero when 
(ai, 02, ... , a„i) e Hq. Since and we are only interested in 
non-zero vectors, we find that 



CkiD) + l 



ftiVi where a e [J 



< 



= 1 




Type 


Non-zero coeffs 


Symm 


Number 


(a) 


1,1,-1,-1 


4 


im.(m — l)(m — 2){m — 3) 


(b) 


2, -1, -1 


2 


^m{m — l){m — 2) 


(c) 


1,1,-2 


2 


^m{m — l){m — 2) 


(d) 


2,-2 


1 


m{m — 1) 



and it is clear that equality is satisfied if and only if the vectors 
X^i" 1 '^i^i where a G Uj=o distinct. Thus the theorem 

follows. ■ 

Corollary 9. The two-hop coverage of a DD(m) is at most 
1 



-m{m — 1)(to — 2)(m — 3) + m{m 

+ 2m(m — 1) = —m(m - 

\ ' 4 ^ 



- l)(m - 
1)K 



2) 

-771 + 6). 



Proof: By Theorem [8] the two-hop coverage is at most 
\Hi \ + \H2\. It is clear that = m{m — 1), since the 777- 
tuples in Hi have exactly two non-zero components, one equal 
to 1 and one equal to —1. To determine \H2\, note that there 
are four types of element in H2, corresponding to the four 
possibilities for the multiset of non-zero coefficients in an 777- 
tuple a G H2 (see Table The number of elements in H2 of 
each type is equal to (1/5)7771/(777- 1)!, where t is the number 
of non-zero components in an 777-tuple of this type, and s is 
the number of symmetries that preserve such ?77-tuples. Thus 

\H2\ — jm{m — 1)(777 — 2)(?77 — 3) + 777(777 — 1)(777. — 2) + 

777(777 — 1), and so the bound of the corollary follows. ■ 
In order to show that the bound of Theorem [8] and Corol- 
lary |9] is tight, we must show that there exists a DD(777) given 
by D = {vi, V2, . . . , v„i} such that the vectors J2"Li o-i^i^ 
where a e i/p U i/i U • • • U Hk, are all distinct. This is not 
difficult to do: for example we may choose Vi = ((2fc+ 1)*, 0) 
for i = 1, 2, . . . , 777. We say that a configuration meeting the 
bound of Theorem [8] has maximal k-hop coverage. Note that 
the example we have just given of a configuration with max- 
imal fc-hop coverage is not useful for our appUcation, as the 
dots in the configuration are exponentially far apart: we would 
like to construct a DD(777, 7') with 7' small having maximal fc- 
hop coverage. In order to do this, we now aim to characterise 
those configurations with maximal fc-hop coverage in terms of 
the much studied concept of Eh sequences (see below). First, 
we make the following observation. 

Lemma 10. The k-hop coverage of a 00(777) given by D = 
{ vi , V2 , . . . , v„i } meets the bound of Theorem^if and only if 
1 CjV, ^ for all c e U.^i Hi. 

Proof: Suppose that D does not meet the bound of Theo- 
rem[8] Then Theorem[8]implies that '^i^i = Ei=i ^jV-i, 

where a, b e Ui=o ^« ^'^'^ a 7^ b. Writing c = a — b we 
have that J2^i '^i^i — 0' *^ ^ U?=i by Lemma |7] 
above. 

Conversely, suppose that there exists £ G {1, 2, . . . , 2fc} and 
c G Hi such that ^i^i = 0- Lemma |7] dinli. we may 
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write c as the sum of I difference vectors. Since multiplying a 
difference vector by the scalar — 1 produces another difference 
vector, we may write c = a — b, where a, b are the sum 
of [^/2J and [^/2] difference vectors respectively. Note that 
a 7^ b since c 7^ 0. But a € ^^[^/2J and b € H^^/2\, where 
< L-^/2j < \l/2\ < \2k/2\ = k, and so Theorem g] implies 
that D does not meet the bound, as required. ■ 

Definition 1. Let A be an abelian group. Let D = 
{vi, V2, . . . , v„i} C A be a sequence of elements of A. We 
say that D is a Bh sequence over A if all the sums 

Vji + H h Vj,^ with I < ii < ■ ■ ■ < ih < m (2) 

are distinct. 

Bfi sequences (sometimes known as S/j-sets) have been 
studied for many years, mainly in the case where A = Z. 
See Graham [17], Halberstam and Roth [18], Lindstrom [19], 
O' Bryant [20], for example. 

Example 1. Let q be a prime power, let h be an integer such 
that h > 2 and let a be a primitive element of GF{q^). Bose 
and Chowla [21] have shown that the set {a € Zqfi_i ja" — a e 
GF((7)} is a Bh set in ljqh_i containing q elements. 

The following theorem demonstrates the relation between Bh 
sequences and distinct difference configurations. 

Tlieorem 11. Let k be a fixed integer, where k > 2. Let D = 
{vi, V2, . . . , v„i} C Z^. Then D is a DD(7ti) with maximal 
k-hop coverage if and only if D is a B2k sequence over 1?. 

Proof: Suppose Z) is a B2k sequence over 1?. We aim 
to show that D is a DD(m) with maximal A:-hop coverage. 

If Vi = Vj for i ^ i then {2k— l)vi +Vi ~ (2fc— l)vi +Vj 
and so D cannot be a i?2fc sequence. This contradiction implies 
that the vectors are all distinct. 

Suppose that — Vj = v^' — Vj', where i 7^ j, i' 7^ /. 
Then (2fc - 2)vi + v, + = {2k - 2)vi + Vj' + v^. This 
contradicts the fact that D is a B2k sequence, unless i ^ i' and 
j' = j. Thus D has the distinct differences property. Hence 
D is a DD(m). 

Suppose, for a contradiction, that D does not have max- 
imal fc-hop coverage. By Lemma [TO] there exists a = 
(ai, a2, . . . , am) G -ffi U • • • U H2k such that X^Ili = 0. 
Define b by 

^ f fli when Gi > 
* [ otherwise. 

Define c by the equation a = b — c. Then the components of b 
and c are all non-negative. Writing t = X]"=i ^ J2'iLi ^ 
>o '■^^ definition of Hi, H2, ■ ■ ■ , i?2fc implies that 1 < 
t < 2k. Since a is non-zero, b 7^ c. But then our choice of a 
implies that 

m m 

{2k - ^)vl + hw, = {2k - t)vi + ^ QV,. 

i=l 1=1 

There are exactly 2k summands on both sides of this equality, 
so D cannot be a B2k sequence. This contradiction shows that 
D has maximal fc-hop coverage, as required. 



Now suppose that D is a DD{m) with maximal fc-hop 
coverage. Assume that D is not a B2k sequence, so there exist 
two distinct sums of the form ^ that are equal. By cancelling 
terms that occur in both sums, we find that X^ilLi ^i^i ~ 
^™ QVi, where the coefficients hi,Ci are all non-negative 
and where X]i=i ~ Si=i = t for some integer t such 
that 1 < t < 2fc. But defining = hi — Ci we find that 
(fli, a2, . . . , ftm) e Ht and J^iLi'^i'^i — 0. Hence D does 
not have maximal fc-hop coverage, by Lemma [TOl as required. 

■ 

The following construction converts a known construction for 
a B2k sequence in Zq2k_i into a B2k sequence in Z^, which 
is a DD(m) with maximal fc-hop coverage by Theorem [TTI 

Construction 1 Let k be a fixed integer such that k > 2. Let 
q be a prime power, and let q^^ — 1 = ab where a and b are 
coprime. Then there exists aset X C Z^ of dots that is doubly 
periodic with periods a and b, and such that the intersection of 
X with any b x a rectangle is a r)D{q) with maximal k-hop 
coverage. 

Proof: The construction of Bose and Chowla [21] de- 
scribed in Example [T] shows there is a B2k sequence over 
Zg2k_i consisting of q elements. Note that by the Chinese 
Remainder Theorem there is a group isomorphism Zg2k_i 
TLa X 2^6 given x ^ {x mod a, x mod 5). Thus there are 
elements vi, V2, . . . , G Z^ x Z;, that form a B2k sequence 
over Za X Zb. Let p : Z^ Zq x Zt be the map defined by 
p{{x, y)) = {x mod a, y mod b). We define X C Z^ to be the 
set of vectors v G Z^ such that p(v) G {vi, V2, . . . , v,}. 

Since p{{x, y)) = p{{x+ia,y+jb)) for any i, j G Z, we see 
that X is doubly periodic with periods a and b respectively. 
Let i? be an 5 X a rectangle in I?. For all i G {1, 2, . . . , m}, 
there is a unique G i? such that p{\'i) = Vj. Hence X n 
R = {vi, V2, . . . Vq}. Moreover, vi, V2, . . . , form a i?2fc 
sequence over Z^, since if there are two sums of the form ^ 
that are equal, then the images of these sums under p are also 
equal, which contradicts the fact that vi , V2 , . . . , Vg form a 
B2k sequence over Za xZ;,. Thus Vi, V2, . . . , Vg form a DD(g) 
with maximal fc-hop coverage by Theorem (TT] as required. ■ 

This construction can be used to prove the existence of a 
DD(m, 7') with maximal fc-hop coverage where r is small: 

Tlieorem 12. Let k be a fixed integer such that k > 2. Define 
c = (7r/16)2^/'"'. Then there exists a DD(?7i,, r) with maximal 
k-hop coverage such that m ^ cr'^/^ . 

Proof: Let 5 C Z^ be the set of points in 1? contained 
in a circle of radius [r/2j about the origin. Note that \S\ = 
(7r/4)r^ + 0{r) (by the Gauss Circle Problem). 

Let q be the smallest prime power such that q^ > 2r. We 
have that q < (2r)^/'^' + ((2r)^/'^)'^/® whenever r is sufficiently 
large by a classical result of Ingham [22] on the gaps between 
primes. In particular, q ^ (2r)^/'^. 

Define the integer a by 

{q'^ — 1 when q is even, 
{q'' - l)/2 when q'' = 3 mod 4, 
{q'' + l)/2 when g*-' = 1 mod 4. 
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Define b ~ {q^^ — I) /a. Since gcA{q^ — 1, + 1) = 1 when 
q is even and gcd{q^ — 1, g*^ + 1) = 2 when q is odd, we find 
that a and h are coprime. Moreover, our choice of q shows 
that r < a < h. Let X be the set of dots in 1? given in 
Construction [T] 

The average number of dots in a shift of S by an element 
of 1? is \S\q/{ah), and so we can find a shift T of 5 
such that \T C^ X\ > \S\q/{ab). Define D C T n X to 
be a subset of size m, where m = \\S\q/{ab)~\. Note that 
m ~ (7r/4)r2g/(2r)2 ~ {Tr/l6)2'^/''r'^/''. Since T is a sphere 
of radius [^72], any pair of dots in D are at distance at most r. 
Moreover, the fact that r < a < b implies that T is contained 
in a 6 X a rectangle R. By Construction [T] i?nX is a D'D{q) 
with maximal fc-hop coverage. Since DCTOXCRnS, 
we see that D is a DD(m, r) with maximal k-hop coverage. 
So the theorem follows, as required. ■ 

Combining Theorems |2] |6] and [12] we have the analogous 
result for the hexagonal grid; 

Corollary 13. Let k be a fixed integer such that k > 2. Define 
c' = (7r/16)2i/'= (l)^^^''- Then there exists a DB* {m,r) with 



maximal k-hop coverage such that m ^ 



For any fixed values of m and k, we define r{k,m) to 
be the smallest value of r such that there exists a DD (m,r) 
with maximal k-hop coverage. It is an important problem to 
determine r(k,ni). The construction in Theorem [T2l provides 
an upper bound on r{k,m), showing that when k is fixed 
and m ^ oo we have r{k, m) = 0{ni^). We now provide a 
corresponding lower bound on r(fc, m), which shows that the 
construction in Theorem [T2] is reasonable: 

Theorem 14. Let k be an integer such that k > 2. Then 

+ oK) < r(fc, m) < i (f )' m'^ + o(m^-)- 

Proof: The upper bound is proved in Theorem [12] 
To prove the lower bound, let Z? be a DD (m,r) with 
maximal k-hop coverage, where r = r{k, m). The definition of 
maximal fc-hop coverage and Theorem [5] show that Ck{D) = 



^til^^l- Let B = {(ai,a2,...,am) e i/fc : \{i 
0}| = 2k}. Clearly \B\ = and 



{m-2k)\k\ 



E 



HA = 



(m-2fc)!fc!2 



+ o{m 



2k\ 



^2k 



+ o(m2'=). 



kl^ 



So Ck{D) = ^ + o{m' 

Every vector counted by Ck{D) is the sum of at most k 
difference vectors of D. Each difference vector has length at 
most r, and so every vector counted by Ck{D) is contained 
in a circle of radius kr centred at the origin. Such a circle 
contains at most TT{kr)'^ + 0{r) vectors in (by Gauss's 
solution to the Gauss circle problem). Thus 

,2k 



m 
TP 



+ o(m2^) = Ck{D) < ^{krf + 0(r), 



which implies the lower bound of the theorem, as required. ■ 
For the hexagonal grid, we denote the smallest r for which 
there exists a DD* (m, r) with complete fc-hop coverage by 



r*{m,k). Combining Theorems [T4| and l2l we have the fol- 
lowing. 



Theorem 15. /f fc > 2 then 



2 ^k\-k 



+ o(m'^) < r*(k,m) < 



In the case fc = 1, we can use the results of [1] to give tighter 
bounds, as every distinct difference configuration has a one- 
hop coverage of m(m — 1), which is thus maximal. 

Theorem 16. We have that 

2 2 

— =TO + o(m) < r(l, m) < —m + 0(171), 

where ji w 0.914769 is the maximum value of ((7r/2) — 26* + 
sin 26) I cos Q on the interval < 6* < 7r/4. 

Proof: It is proved in [1] that if a DD(TO,r) exists, 
then m < -^r + 0{r'^/^), which gives rise to the lower 
bound on r(l,m). Furthermore, [1] contains a construction 
of a DD(m, r) with m = {l^/2)r + o(r) dots, from which we 
derive the upper bound. ■ 
The paper [1] also contains analogous results in the hexagonal 
grid. From these, we can deduce the following bounds on 
r* (1, m): 

Theorem 17. We have that 

^31/4 21/231/4 

^= — m + o(m) < r* (1, 771) < m + 0(77?,), 

where fi is defined as in Theorem[T6l 

Recall that we introduced the Manhattan and hexagonal 
metrics on the square and hexagonal grids respectively in 
Section [11] We conclude this subsection with a brief discussion 
about the situation when we use these metrics rather than 
Euclidean distance. For integers fc and 777, define r{k,m) to 
be the smallest integer r such that there exists a DD(777,r) 
with maximal fc-hop coverage, and define r*{k,m) to be the 
smallest integer 7' such that there exists a DD (777, r) with 
maximal fc-hop coverage. 

Theorem 18. Let k be a fixed integer, fc > 2. There exist 
constants ci, 02,03 and C4 such that for all sufficiently large 
integers m 

Cim'^ < r{k,m) < C2'm}' and 
c^m^ < r*{k,m) < c^m'^ . 

Proof: By Theorem [3] a DD(777,r) with maximal fc-hop 
coverage is also a DD(777, ?') with maximal fc-hop coverage. 
So r{k,m) < r{k,rn). Moreover, a DD(77i, r) with maximal 
fc-hop coverage is a DD(m, [v^H ) with maximal fc-hop 
coverage, so r{k,m) < \\/2r{k, 111)1. The first statement of 
the theorem now follows by Theorem [14] 

The proof of the second statement of the theorem is similar, 
using Theorems |4] and [15] in place of Theorems [3] and [14] 
respectively. ■ 

The results in [1] can be used to establish the following: 
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Theorem 19. We have that 

r(l, to) = \f2m + o(m). 

Moreover, 

(2/V3)m + o(TO) < r*(l,m) < (2/^)to + o(to), 
where /i = (2/3)3/2(1 + 2V7)/{V2 + V7) w 1.58887. 

C. Minimum k-hop coverage 

Having established an upper bound for the fc-hop coverage 
of a DD(to) (and hence of a DD*(to)), we now consider the 
smallest values it can take. 

Theorem 20. The k-hop coverage of a DD(7ti) is at least 
km{m — 1). 

Proof: The one-hop coverage of a DD(to) is m(m— 1). 

For D = {vi, V2, . . . , v„i} a DD(to), let u = (d, e) be the 
difference vector with \d\ as large as possible. If there is more 
than one choice for u, choose u with |e| as large as possible 
subject to \d\ being maximal. Without loss of generality, we 
can assume that d > Q and e > (if not we can flip and rotate 
the array to obtain an equivalent array with such vector). 

Let 5*1 be the set of to(to — 1) vectors that can be reached 
by one-hop paths from the origin. Then Si can be written as 
the disjoint union of the two sets 

= {{x,y)\{x,y) e Si, x > or (x = and y > 0)} 

and S^ ={~{x,y)\{x,y)eS+}. 
For i > 1, we define 

S, = {-w + {i- l)u|w e S^} u 
{(-w- (i- l)u|w e S+}. 

As u is a difference vector of D, the vectors of Si can all be 
reached by i-hop paths from the origin. Furthermore, SiDSj = 
for i ^ j and |S'i | = TO(m— 1). Hence, the theorem is proved. 

For certain values of to there exist DD(m) for which the 
above bound is tight. For example, consider the following 
DD(3): 



The difference vectors in this example are 
{±(1,0), ±(2,0), ±(3,0)}, and hence any of the 6k 
vectors of the form ±(t, 0) for < t < 3fc can be reached by 
a fc-hop path. 

We can construct more examples where the bound is tight 
as follows. A Golomb ruler is a set M of to integers such 
that the differences x — y where x,y G M and a; 7^ y are all 
distinct. A Golomb ruler is perfect if 

{u - v. u,v e S] = {i e 1 : \i\ < m{m - l)/2}. 

For example, the sequence {0,1,3} is a perfect Golomb 
ruler. The DD(3) above was constructed from this sequence 
by taking appropriate multiples of the vector (1,0). More 
generally, if M is a perfect Golomb ruler then a configuration 
D consisting of the vectors r ± js where i G i\/ is a DD(m) 
with a fc-hop coverage of km{m — 1), and so meets the bound 



of Theorem |20] We say that D is equivalent to a perfect 
Golomb ruler if we can construct it in this way. In fact, we 
will now show that a DD(m) meets the bound of Theorem l20l 
if and only if it is equivalent to a perfect Golomb ruler 

Lemma 21. Let fc be an integer, fc > 2. Suppose D is a DD(?ti) 
in which there are differences d and d' that are not parallel. 
Then the k-hop coverage of D is strictly greater than km{m — 

1)- 

Proof: Define the difference vector u and the sets Si as 
in the proof of Theorem |20l The set of difference vectors not 
parallel to u is non-empty by assumption. Let v be a difference 
vector whose projection in the direction perpendicular to u 
has length p{v) as large as possible. Since fc > 2, the fc-hop 
coverage of D is at least 

\SiUS2i)---USkU{2v}\. 

The argument in Theorem |20] shows the sets Si are disjoint 
and have order to(to — 1). So the theorem follows if we can 
show that 2v ^ 5*1 U 5*2 U • • • U Sfe. But any vector in 5*^ can 
be written in the form w ± (i — l)u where w is a difference 
vector, and therefore 

p(w ±{i - l)u) = p(w) < p(v) < 2p(v) = _p(2v). 

Hence 2v does not lie in any of the sets Si, as required. ■ 

Theorem 22. Let fc be an integer such that fc > 2, and let D be 
a DD(m). Then D meets the bound of Tfieoreml20l if and only 
if it is equivalent to a perfect Golomb ruler. 

Proof: It is easy to see that if D is equivalent to a perfect 
Golomb ruler, then D meets the bound of Theorem |20l 

Let I? be a DD(m) that meets the bound of Theorem |20l 
The set Si defined in the proof of Theorem [20] is a set of 
m{m — 1) vectors that can be reached by an ^-hop path from 
the origin, but cannot be reached by a path of length £ — 1. 
Thus CkiD) > C2{D) + (fc - 2)to(to - 1), so D meets the 
bound of Theorem [20] in the case fc ~ 2. So to prove the 
theorem, we need only consider the case fc = 2. 

Let r be a vector in D. Lemma |2T] implies that all the 
difference vectors in D are parallel to a fixed vector u. Let s 
be the shortest vector in 1? that is parallel to u. Then (since 
7? is a lattice) _D C {r + is | i G Z}. Thus D is equivalent to 
a Golomb ruler M C Z. Without loss of generality, we may 
assume that the greatest common divisor of the elements of 
M is 1, for if the greatest common divisor is a then we can 
replace s by as and M by {l/a)M. 

It remains to show that A/ is perfect. The set S — {x ~ 
y\x, y G A/} contains m{m — 1) + 1 elements, since M is a 
Golomb ruler. A square reachable from the origin by a one-hop 
or two-hop path corresponds to an element of 5 + S' = {a + 
fe|a, b G 5}. It is a well-known result of additive combinatorics 
that for a set A of integers with \A\ = n it holds that |^±A| = 
2?i — 1 if and only if the elements of A are in arithmetic 
progression. The bound of Theorem|20]requires 5 + S* to have 
size 2m{m — 1) + 1 (due to the inclusion of 0); as this is equal 
to 215*1 — 1 it follows that the elements of S are in arithmetic 
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progression. Since S — ~S and the greatest common divisor 
of the elements of M is 1 we find that S = {x £ Z \ \x\ < 
m{m — l)/2}. So M is a perfect Golomb ruler, as required. 



IV. A DD(77i) WITH Complete Two-Hop Coverage in 
A Rectangle 

In Section |lll] we explored the range of values that the k- 
hop coverage of a distinct difference configuration can take. 
When choosing a distinct difference configuration for use in 
Scheme [T] it may seem desirable to select a configuration 
with maximal two-hop coverage. However, from Theorem [T4l 
we see that a DD(m, r) with maximal two-hop coverage has 
"approximately" jti^ = r, which places too great a restriction 
on the maximum number of keys that each node can store in 
the resulting scheme. From a practical perspective it thus may 
be desirable to focus on connectivity within a localised region. 

In this section we give a construction of a DD(77i) that 
ensures a two-hop path between a given point x and any other 
grid point within a (2p — 3) x (2p — 1) rectangle centred at x, 
where p is any prime greater than or equal to five. This allows 
the region to be tailored to the requirements of a specific 
application environment. 

Our construction can be thought of as being based on the 
periodicity properties of a B2 sequence in Z(p2_p-) proposed by 
Ruzsa in [23], or as a consequence of a periodic generalisation 
of the Welch construction of a Costas array [24]. In Sub- 
section IIV-AI we discuss some properties of a related doubly 
periodic array that we will exploit later. In Subsection IIV-BI 
we present the construction and demonstrate that it achieves 
complete two-hop coverage. 



A. The Welch Periodic Army 

Definition 2. (Welcli Periodic Array) Let a be d primitive root 
modulo a prime p. We deSne the Welch periodic array to be the 
set 

TZp = e Z^ja-' = i modp}. 

This array is doubly periodic in the sense that if TZp contains 
a dot at position {i,j) then it also contains dots at all positions 
of the form {i + Xp, j + ij.{p — 1)) where A, /i e Z. It has a 
distinct difference property "up to periodicity": see the lemma 
below. We say that dots A and A' at positions {i, j) and (i', f) 
are equivalent, and we write A = A' , \f i' = i + \p and 
j' = j + fi{p — 1) for some X, fj, £ Z. 

Lemma 23. Let d and e be integers such that d ^0 mod p and 
e ^ mod (p — 1). Suppose that TZp contains dots A and B 
at positions and {ii + d,ji + e) respectively, and dots 

A' and B' at positions (12, J2) and (^2 + d, + e) respectively. 
Then A = A' andB = B' . 



Proof: By the definition of TZp we have 

11 = a^^ mod p 

12 = oP^ mod p 

ii + d = a^^^"^ mod p 
12+ d = a-'^^^ mod p. 

Eliminating ii, 12 and d from these equations we get 

{a"" - l){a^^ - a^'') = mod p. 

Since e ^ mod (p—l), this implies that ji = j2 mod (p— 1). 
The first two equations above then imply that ii= 12 mod p. 

■ 

We note that in addition, if TZp contains dots at and 
{i + d,j) then d = {) modp and if it contains dots at 
and (i, j + e) then e = mod (p — 1). Thus we see that a 
vector (d, e) can occur at most once as a difference between 
two of the dots of TZp that lie within any particular (p—l) x p 
rectangle. 

B. Construction of the Ym{m) 

We now define a DD(7ti) by choosing a finite subset of the 
dots in TZp, as follows. 

Construction 2 Letp be an odd prime. Let {i, j) e be such 
that TZp has dots at and {i + l,j + 1). Note that such a 
position exists. To see this, let i and 7 be integers such that 

a-^ = i = mod p. 

The right-hand side of this equality is well-defined and non- 
zero modulo p, and so there is a suitable choice for i and j. 
Clearly TZp has a dot at the position But there is also a 

dot at (i + 1, j + 1) since 

■ 11 a 1 

a-' = = 1-1 = 7 + 1 mod p. 

a — 1 a — 1 

Consider the {p — 1) x p rectangle S bounded by the positions 
(i+p - (i, j + p- 2) and (i + p - 1, j + p - 2). 
By construction, TZp has p—l dots in S. Due to its periodic 
nature, TZp also has dots atpositions + (p — 1)), {i +p,j) 
and (i + p + 1 , j + p) . We construct a configuration B by adding 
these three dots to the set of dots in TZp n S. 

Our configuration B is shown in Fig. |3] The configuration 
is contained in a (p + 1) x (p + 2) rectangle. The border region 
of width 2 contains exactly 5 dots: A, A! , A", B and B'. The 
central region is a (p — 3) x (p — 2) rectangle. This region 
contains p — 3 dots: one column is empty, but every other 
column and every row contains exactly one dot. Note that 
A = A' = A" and B = B', but there are no other equivalent 
pairs of dots in B. 

Lemma 24. The configuration B is a DD(p + 2), all of whose 
points lie in a (p + 1) x (p + 2) rectangle. 
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Fig. 3. The configuration B. The five dots shown are the dots that lie 
the border of width 2 of the x (p + 2) rectangle containing the 

configuration. 

Proof: We have already remarked that B contains p+2 
dots, all lying in a (p + 1) x (p + 2) rectangle. So it remains 
to show that B satisfies the distinct differences property. 

Suppose, for a contradiction, that X and Y, and X' and Y', 
are distinct pairs of dots in B with the same difference vector 
id,e). 

Suppose that d € {0, —p,p} or e G {0, —{p — 1), {p — 1)}. 
A difference vector between a dot in the central region of our 
configuration and any other dot has x— and y— coordinates of 
absolute value at most p — 1 or p — 2 respectively. Moreover, 
a central dot is the only dot in its row and column. So our 
assumption implies that none of X, X' ,Y,Y' can lie in the 
central region of our configuration. But the 5x4 ordered pairs 
of dots in the border region all have distinct difference vectors, 
and so we have a contradiction in this case. 

So we may assume that d ^ {0, —p,p} and e ^ {0, — (p — 
1 ) , (p — 1 ) } . In particular, since all dots lie in a {p+l)x{p+2) 
rectangle, we see that d ^ mod p and e ^ mod (p — 1). 
Lemma |23] now implies that X = X' and Y = Y . If X ^ 
X' then Y — Y' which contradicts the fact that our pairs 
of dots are distinct. Hence X ^ X'. The fact that X = X' 
now implies that X and X' must lie in the border of our 
configuration. A similar argument implies the same is true 
for Y and Y'. As in the paragraph above, we now have a 
contradiction. Thus the lemma follows. ■ 

Our aim is to show (Theorem |27]| that B achieves complete 
two-hop coverage on a {2p — 3) x {2p — 1) rectangle relative 
to the central point of the rectangle. In order to demonstrate 
this, it is necessary to show that every vector {d, e) with \d\ < 
p — I and |e| < p — 2 can be expressed as a two-hop path of 
difference vectors from B. The following lemma proves this 
for the majority of such vectors {d, e). 

Lemma 25. Any vector of the form {d, e), where d and e are 
non-zero integers satisfying \d\ < p—l and \e\ < p — 2, can be 
expressed as the sum of two difference vectors from B. 

Proof: Consider the (p—l) x p rectangle S defined in 
Construction |2] and let A be the restriction of TZp to the (2p — 



2) X 2p subarray whose lower leftmost corner coincides with 
that of S. 

We partition A into four (p—l) x p subarrays as follows: 



T^3 






V2 , 



The periodicity of TZp means that the set of dots of TZp 
contained in each subarray is a translation of the set of dots 
of TZp contained in Vi. Moreover, since T)i = S, all the dots 
in T>i are contained in B. 

We claim that each of the vectors {d, e) appears as the dif- 
ference of two points in A. Since the negative of a difference 
vector is always a difference vector, we may assume without 
loss of generality that d > 0. Suppose that e > 0. There is a 
unique position {i' G T>i such that 

)' ■' ^ A 
or = I = mod p. 

a" - I 

It is easy to check, just as in Construction |2] that TZp has dots 
at («',/) and (z' + rf, 7' + e). Since d and e are both positive, 
{i' + d, j' + e) lies in A, and so our claim follows in this case. 
The argument for the case when e < is exactly the same, 
except now we choose G T>s- So the claim follows. 

To prove the lemma, we need to show that each difference 
vector (d, e) can be written as the sum of two difference 
vectors of B. This follows from the paragraph above and the 
following observations: 

• Any vector connecting two dots of Vi is a difference 
vector of B by construction. 

• Due to the periodicity of TZp, a vector connecting a dot 
in Vi with a dot in 2?3 (or, similarly, a dot in 2?2 with 
a dot in 1)4) can be expressed as the sum of the vector 
(0,p— 1) (which occurs as a difference between the dots 
A and A' in B) and some other difference vector of B. 

• A vector connecting a dot in Vi with a dot in T>2 (or, 
similarly, a dot in P3 with a dot in P4) can be expressed 
as the sum of the difference vector (p, 0) (which occurs 
between A and A") and some other difference vector of 
B. 

• A vector connecting a dot in T>i with a dot in X>4 is 
the sum of the difference vector (p,p — 1) (which occurs 
between B and B') and some other difference vector of 
B. 

• A vector connecting a dot in P3 with a dot in V2 is the 
sum of the difference vector (p, — (p — 1)) (which occurs 
between A' and A") and some other difference vector of 
B. 

■ 

It remains to consider vectors that have a zero co-ordinate. 
We will use the following lemma in our proof that such vectors 
all occur as the sum of two difference vectors from B. 

Lemma 26. Let t be a positive integer with < > 3. Let T be a 
set of integers satisfying the following properties: 

(a) 1^1 =f+l, 

(b) .FC {-(t-l),-(t-2),...,-l}U{l,2,...,t-l}U 

+ li- 
fe) {l,-(t- l),i+ 1} c T, 
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(d) 3i e \ {1, -(t - 1), t + 1} with i < 0, 

(e) ifi >Oandie J^\{l,-{t- l),t + 1} theni- t ^ T. 
Then each positive integer 7 with I < j < t — 1 has a 
representation of the form J = j — i where i,i <E T. 

Proof: Since J^\{l,-(t-l),t+l} contains t - 2 ele- 
ments, (|e|) implies that T must contain precisely one element 
of each pair {«, i — for i = 2, 3, . . . , t — 1. Suppose, for a 
contradiction, that there exists a positive integer 7 < i — 1 that 
cannot be expressed as the difference between two elements 
of T. 

Suppose that 7 > 1. Since l,t+ 1 e T, our assumption 
implies that 1 — 7 ^ and t + 1 — 7 ^ T. But 1 — 7 = 
(t + 1 — 7) — hence one of these numbers must be contained 
in T, which gives a contradiction in this case. 

Suppose that 7=1. The assumption implies that T does 
not contain a pair of integers that differ by 1 . If t is odd this 
implies that T\{t + 1} contains at most {t — l)/2 positive 
integers, and at most {t — l)/2 negative integers, hence T 
contains at most (i — 1) + 1 = t integers, which contradicts 
dDi. If t is even, then in order for the size of to be t + 1, 

\ {t + 1} must contain t/2 positive integers, all of which 
are odd, and t/2 negative integers that are also all odd. This 
implies that for each positive odd integer 1 < z < t we have 
that i e and i — tE!F, which contradicts (|ej. So the lemma 
follows. ■ 
We can now combine these two lemmas to obtain our desired 
result: 

Theorem 27. Letp be a prime, p > 5. The distinct difference 
configuration B achieves complete two-hop coverage on a 
(2p — 3) X (2p — 1) rectangle relative to the central point of 
the rectangle. 

Proof: By Lemma|25] any vector {d, e) from the centre of 
a (2p— 3) X (2p— 1) rectangle to another point of the rectangle 
can be expressed as the sum of two difference vectors of B if 
d and e are non-zero. 

We now consider vectors of the form (0, e) with < e < 
p — 2. Such a vector can be expressed as the sum of two 
difference vectors of B if B has difference vectors of the form 
(1, y') and (1, y) with y' — y ^ e. The second coordinates of 
the set of difference vectors of B of the form (1, ?;) with y ^ 
satisfy the conditions of Lemma |26] for t = p — 1, since; 

(a) The left-most column of the array contains two dots; all 
other columns contain a single dot apart from a single 
central column which is empty. So B has p difference 
vectors of the form {l,y) with y ^ 0- 

(b) Except for the vector all difference vectors of B of 
the form (1, y) with y 7^ satisfy \y\ <p~ 2. 

(c) The vectors (1,1), (l,-(p- 2)) and (l,p+ 1) are all 
difference vectors of B (as they occur as differences 
between dots in the border region of B, see Fig. |3]l. 

(d) The difference vectors of B of the form (1,?;) cannot all 
satisfy y > 0. This is obvious if the right-most central 
column contains a dot. If this column is empty and y 
is always positive, then the remaining (p — 3) x (p — 3) 
central region must contain dots along a lower-left to top- 
right diagonal. Since p > 5, two central dots have the 



difference vector (1,1). Since dots A and B also have 
this difference vector, the distinct difference property is 
violated and so we have a contradiction, as required, 
(e) If (l,j/) with y ^ l,p is a difference vector of B then 
(1, y — {p — 1)) is not. For Lemma |23] implies that the 
dots involved must be equivalent, and so must be in the 
border region of our construction. 

Lemma |26] now implies that any vector (0,e) with < e < 
p — 2 has an expression in the form (0, e) = (1, y') + (—1, —y) 
where (l,y') and (1,?;) are difference vectors of B. Vectors 
of the form (0, e) with — (p — 2) < e < can be written as 

(l,y) + (-l,-y')- 

In a similar manner, we can show that the first coordinates 
of the difference vectors of B of the form {x, 1) satisfy the 
conditions of Lemma |26] with t = p, and hence any vector of 
the form {d,0) with < \d\ < p — 1 can be written as the 
sum of two difference vectors of B. Thus the result is proved. 

■ 

We can thus apply the DD{ra) specified in Construction |2] 
to Scheme [T] in order to establish a key predistribution scheme 
which guarantees two-hop paths between a node and all of 
its neighbours within a surrounding rectangular region. This 
provides a powerful notion of local connectivity in order to 
facilitate connectivity across the wider network. The resulting 
scheme is also highly configurable, since the value of p can 
be adjusted in order to tradeoff storage against the size of the 
fully connected local region. 

V. Conclusion and Open Problems 

In this paper we have studied properties of distinct differ- 
ence configurations, which can be used to design efficient key 
predistribution schemes for wireless sensor networks based on 
grids. 

In Section |lll] we explored the fc-hop coverage of a 
DD(m, r). We characterised maximal fc-hop coverage in terms 
of B2k sequences over 1?, and we used a known construction 
of i?2fc sequences over Z to produce a DD(m, r) with maximal 
fc-hop coverage and of the order of r^/^ dots. We provided an 
argument that shows that the order of magnitude of the number 
of dots is correct (by bounding the functions 7'(fc, in)). These 
results indicate the range of achievable parameters, which 
in turn determine the connectivity properties of the resulting 
key predistribution schemes. It would be interesting to find 
better bounds on the leading coefficient of r(fc, m), and it 
would be worthwhile determining r(fc, m) precisely for small 
values of fc and m. Similar comments hold for the function 
r* (fc, m), and for the analogous situations using the Manhattan 
or hexagonal metric. 

In Section|lV]we constructed a DD(m,r) with complete 2- 
hop coverage within a large rectangular region centred on the 
origin. This DD{m,r) can be used to design key predistri- 
bution schemes with excellent local connectivity properties. 
The area of the fully connected region is of the order of 
m?. It would be interesting to investigate whether there are 
any constructions that achieve complete two-hop coverage in 
significantly larger rectangles. Constructions that are optimised 
with respect to two-hop coverage for other natural regions, for 
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example a circle of large radius, would also be of practical 
interest. A further open problem is whether there exist any 
good constructions, for any natural region, achieving complete 
fc-hop coverage for fc > 3. 

References 

[1] S.R. Blackburn, T. Etzion, K.M. Martin, and M.B. Paterson, "Two- 
dimensional patterns with distinct differences: Constructions, bounds 
and maximal anticodes," preprint, 2008. 

[2] S.R. Blackburn, T. Etzion, K.M. Martin, and M.B. Paterson, "Effi- 
cient key predistribution for grid-based wireless sensor networks," in 
(R. Safavi-Naini, Ed) Proc. ICITS 2008, Lecture Notes in Computer 
Science 5155, Springer- Verlag, Berlin, pp. 54-69, 2008. 

[3] K. Romer and F. Mattern. The design space of wireless sensor networks. 
IEEE Wireless Communications Magazine, 11(6):54-61, 2004. 

[4] S.A. (J^amtepe and B. Yener, "Key Distribution Mechanisms for Wireless 
Sensor Networks: a Survey", Rensselaer Polytechnic Institute Tech. Re- 
port TR-05-07 March 2005. 

[5] K.M. Mailin and M.B. Paterson, "An Application-Oriented Framework 
for Wireless Sensor Network Key Establishment", Electron. Notes Theor 
Comput. Sci., vol. 192, pp. 31^1, 2008. 

[6] Y. Xiao, V.K. Rayi, B. Sun, X. Du, F. Hu and M. Galloway, "A survey 
of key management schemes in wireless sensor networks", Comput. 
Commun., vol.30, pp. 2314-2341, 2007. 

[7] L. Eschenauer and V.D. Gligor "A key-management scheme for dis- 
tributed sensor networks", CCS '02: Proc. of the 9th ACM Conference 
on Computer and Communications Security, pp.41— 47, 2002. 

[8] Institut fiir Chemie und Dynamik der Geosphare (ICG), Forschungszen- 
trum Julich: SoilNet - a Zigbee based soil moisture sensor network. 
http://www.fz-juelich.de/icg/icg-4/index. php ?index=739 2008. 

[9] Integrated smart sensing systems. |http://dpi.projectforum.com/isss/l l] 
2007. 

[10] J. McCulloch. P McCarthy, S. M. Guru, W. Peng, D. Hugo, and A. Ter- 
horst. Wireless sensor network deployment for water use efficiency in 
imgation. In REALWSN '08: Proceedings of the Workshop on Real- 
world Wireless Sensor Networks, pages 46-50, New York, NY, USA, 
2008. ACM. 

[11] J.H. Conway and N.J. A. Sloane, Sphere Packings, Lattices, and Groups, 
New York: Springer- Verlag, 1993. 

[12] J. Lee and D.R. Stinson "On the construction of practical key predis- 
tribution schemes for distributed sensor networks using combinatorial 
designs", ACM Trans. Inf. Svst. Secur, vol. 11(2), pp. 1-35, 2008. 

[13] W. Du, J. Ding, Y.S. Han,' PK. Varshney, J.Katz and A.Khalili "A 
pairwise key pre-distribution scheme for wireless sensor networks", 
ACM Trans. Inf Syst. Secur, vol.8, pp. 228-258, 2005. 

[14] H. Chan, A. Perrig and D. Song "Random key predistirbution schemes 
for sensor networks" IEEE Sumposium on Securitv and Privacy, 
pp. 197-213, 2003. 

[15] S.A. (J^amtepe, B. Yener and M. Yung "Expander graph based key 
distribution mechanisms in wireless sensor networks", ICC '06, IEEE 
International Conference on Communications, pp. 2262-2267, 2006. 

[16] D. Liu, P. Ning and R. Li "Establishing pairwise keys in distributed 
sensor networks", ACM Trans. Inf. Svst. Secur, vol. 8(1), pp. 41-77, 
2005. 

[17] S.W. Graham, "B/j sequences". Analytic Number Theory, Vol. 1 (AUer- 

ton Park, IL, 1995), Birkhauser, Boston, pp. 431^49, 1996. 
[18] H. Halberstam and K.R Roth, Sequences, Volume I, London: OUP 1966. 
[19] B. Lindstrom, "On B2 sequences of vectors", J Combinatorial Theory, 

vol.4, pp. 261-265, 1972. 
[20] K. O'Bryant, "A complete annotated bibliography of work related to 

Sidon sequences". Electron. J. Combin Dynamic Survey 1 1 , 2004. 
[21] R.C. Bose and S. Chowla, "Theorems in the additive theory of numbers". 

Comment. Math. Helvet. vol. 37, pp. 141-147, 1962-63. 
[22] A.E. Ingham, "On the difference between consecutive primes". Quart. 

J. Math. Oxford (Old Series), vol. 8, pp. 255-266, 1937. 
[23] I.Z. Ruzsa "Solving a lineal' equation in a set of integers". Acta Arith., 

vol.65, pp. 259-282, 1993. 
[24] S.W. Golomb and H. Taylor "Constructions and properties of Costas 

arrays". Proceedings of the IEEE, vol.72, pp. 1 143-1 163, 1984. 



Oxford in 1992. Since then he has worked at Royal Holloway, University of 
London as a Research Assistant (1992-95), an Advanced Fellow (1995-2000), 
a Reader in Mathematics (2000-2003) and a Professor in Pure Mathematics 
(2004-). He was Head of the Mathematics Department from 2004 to 2007. 
His research interests include cryptography, group theory, and combinatorics 
with applications to computer science. 



Tuvi Etzion (M'89-SM'99-F'04) was born in Tel Aviv, Israel, in 1956. He 
received the B.A., M.Sc, and D.Sc. degrees from the Technion - Israel 
Institute of Technology, Haifa, Israel, in 1980, 1982, and 1984, respectively. 

From 1984 he held a position in the department of Computer Science at the 
Technion, where he has a Professor position. During the years 1986-1987 he 
was Visiting Research Professor with the Department of Electrical Engineering 
- Systems at the University of Southern California, Los Angeles. During the 
summers of 1990 and 1991 he was visiting Bellcore in Morristown, New 
Jersey. During the years 1994-1996 he was a Visiting Research Fellow in the 
Computer Science Department at Royal Holloway, University of London. He 
also had several visits to the Coordinated Science Laboratory at University of 
Illinois in Urbana-Champaign during the years 1995-1998, two visits to HP 
Bristol during the summers of 1996, 2000, several visits to the department 
of Electrical Engineering, University of California at San Diego during the 
years 2000-2009, and to the Mathematics department at Royal Holloway, 
University of London during the years 2007-2009. His research interests 
include applications of discrete mathematics to problems in computer science 
and information theory, coding theory, and combinatorial designs. 

Dr Etzion was an Associate Editor for Coding Theory for the IEEE 
Transactions on Information Theory from 2006 till 2009. 



Keith M. Martin joined the Information Security Group at Royal Hol- 
loway, University of London as a lecturer in January 2000. He received 
his BSc (Hons) in Mathematics from the University of Glasgow in 1988 
and a PhD from Royal Holloway in 1991. Between 1992 and 1996 he 
held a Research Fellowship in the Department of Pure Mathematics at the 
University of Adelaide, investigating mathematical modeling of cryptographic 
key distribution problems. In 1996 he joined the COSIC research group 
of the Katholieke Universiteit Leuven in Belgium where he was primarily 
involved in an EU ACTS project concerning security for third generation 
mobile communications. He has also held visiting positions at the University 
of Wollongong, University of Adelaide and Macquarie University. Keith's 
cun'ent research interests include cryptography, key management and wireless 
sensor network security. 

Prof. Martin is an Associate Editor for Complexity and Cryptography for 
IEEE Transactions on Information Theory. 



Maura B. Paterson received a BSc from the University of Adelaide in 2002 
and a PhD from Royal Holloway, University of London in 2005. She has 
worked as a research assistant in the Information Security Group at Royal 
Holloway, and is currently at the Department of Economics, Mathematics and 
Statistics at Birkbeck, University of London. Her research interests include 
applications of combinatorics in information security. 



Simon R. Blackburn received his BSc in Mathematics from the University 
of Bristol in 1989, and his DPhil in Mathematics from the University of 



